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AMENDMENTS TO CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in 
the application. 

1 . (Currently amended) An apparatus for performing a SubByte function of the Rijndael 
Block Cipher, comprising: 

an S-box circuit including 

an inverse transformation circuit having a lookup table and being configured 
and arranged to transform an input using a look-up table , wherein the look-up table is 
the multiplicative inverse in the finite field GF(2^) having (00) mapped to itself, and 
the look-up table is implemented by a read-onlv memory (ROM) : 

a combinational logic circuit configured and arranged to perform an aflfine-all 
transformation that performs both an affine and inverse affine transformation in 
response to respective load patterns , wherein the combinatorial logic circuit 
implements the equations: 

l>*o=[(bo • Po)©(bi • pi)®(b2 • p2)eCb3 • P3)e(b4 • P4)e(b5 • Ps)e(b6 * P6)e(b7 • P7)]©Vo 
* b'i-I(bo • P7)©(bi • po)®(b2 • pi)®(b3 • P2)e(b4 • P3)©(b5 • P4)®(b6 • P$)e(b7 • P6)]©Vi 

b'2^[(bo • P6)e(b| • p7)©(b2 • po)®(b3 • p|)©(b4 • p2)e(b5 • P3)e(b6 - P4)e(l>7 " P5)]®V2 
b'j=[(bo • P5)e(b| • P6)e(b2 • P7)e(b3 - Po)^A • Pl)e(b5 • P2)e(b6 • P3)e(b7 • P4)]®V3 
b*4=[(bo • P4)©(b| • P5)e(bz • p6)e(b3 • p7)^4 • P0)e(b5 • Pl)©(b6 • P2)e(b7 • P3)1®V4 

b'5=[(bo • P3)©(b| • P4)©(b2 • P5)®(b3 • P6)®(b4 • P7)©(b5 * Po)®(b« • Pi)e(b7 • P2)]©V5 

b*6^{bo • P2)®(bi • P3)eCb2 * p4)e(b3 • P5)e(b4 • P6)e(b5 • P7)®(b6 • po)e(b7 * pi)]ev6 
b'7=[(bo • pi)e(bi • P2)®(b2 • P3)e(b3 • P4)e(h4 • Ps)®(b$ • P6)®(b6 • P7)e(b7 • pa)3®V7 

having p = pnpip ^ip^ ps p fip? as a load pattern consisting of {10001 1 1 1 } for the affme 
transformation and (00100101} for the inverse affmc transformation and having v as a 
load vector = vnViVgVj VaVsv^v? consisting of (1 10001 10} for the affine transformation 
and {101000001 for the inverse aflfme transformation . 

2-3. (Cancelled). 

4. (Previously presented) An apparatus for encrypting and decrypting data, comprising: 

a data processing module arranged to perform a byte substitution, wherein at least part 
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of said data processing module comprises: 

a look-up tabl e which is the multiplicative inverse in the finite field GF(2 ) having 
{00} mapped to itself, and the look-up table is implemented bv a read-only memorv fROM\ 

a storage device for storing the look-up table, and 

a circuit having shared logic that performs a single transform that accomplishes an 
affine and an inverse affine transformation , wherein the circuit having shared logic 
implements the equations: 

b'(f=I(bo • Po)®(bl • Pl)®(b2 • P2)e(b3 • P3)e0>4 • P4)®(b5 • P5)^6 ' P6)e(b7 • P7)]®Vo 

' b' ,=[(bo ' P7)e(b| • po)a(b2 • pi)e(b3 • P2)®(b4 * P3)®(b5 • P4)®(b6 • P5)e(b7 • P6)]©V| 
b'2=[(bo • P6)©(bi • P7)e(b2 • pa)e(b3 • pi)e(b4 • P2)e(b5 • P3)e(b6 • P4)e(b7 • ps)]^2 

b*3=[(bo • P5)©(b| • P6)©(b2 • p7)®(b3 • Po)e(b4 • Pl)e(b5 • P2)®(b6 • P3)e(b7 • P4)]eV3 

b*4=[(bo • P4)©(bi • Ps)®(b2 • p6)e(b3 • P7)®(b4 • Po)e(b5 • pO®(b6 * Pi)e(b7 • P3)]ev4 

b'5=[(bo * P3)©(bi • P4)e(b2 ^ P5)e(bj • P6)©(h4 ♦ P7)e(b5 • po)e(b^ • Pl)e(b7 • P2)]©V5 

b*6=[(bo • P2)e(bi • P3)©(b2 • P4)e(b3 • P5)©(b4 • P6)©(b5 • P7)e(b6 • Po)e(b7 • Pl)]©V6 

b'7=[(bo • pi)e(b, • P2)e(b2 • P3)e(b3 • P4)e(b4 • p5)e(b5 • P6)e(b6 • P7)e(b7 • po)]®v7 

having p = pn pjpTPiP^PjP^p? as a load pattern consisting of (10001 11 U for the afiRne 
transformation and (00100101 ) for the inverse affme transformation and having v as a load 
vector = vn Vj^V2V^V4Vw^V7 consisting of ( 1 10001 101 for the affine transformation and 
{10100000} for the inverse affine transformation . 

5-7. (Cancelled) The apparatus as claimed in claim 4 wherein said look-up table is a 
multiplicative inverse of the finite field GF(2'). 

8. (Original) The apparatus as claimed in claim 4, wherein the apparatus comprises a plurality 
of instances of a data processing module arranged in a data processing pipeline. 

9. (Original) The apparatus as claimed in claim 4, wherein the apparatus is arranged to 
perform encryption or decryption in accordance with the Rijndael Block Cipher, and wherein 
the data processing module is arranged to implement a Rijndael round. 

10. (Original) An apparatus as claimed in claim 9, wherein the data processing module is 
arranged to implement the SubByte transformation of the Rijndael round using the lookup 
table composed with the affine transformation for encryption and the inverse affine 
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transformation for decryption. 

11. (Previously presented) The apparatus as claimed in claim 10, wherein said look-up table is 
implemented by means of a read only memory (ROM). 

12. (Currently amended) A apparatus for performing a SubByte function of a round of the 
Rijndael Block Cipher, comprising an S-box constructed by composing, 

means for obtaining the multiplicative inverse in the finite field GF(2 ), and 

means for performing an affine-all transformation consisting of an affine and inverse 

aflfine transformation as a single affine transformation , wherein the means for performing 

implements the equations: 

b'o=[0>o • Po)®(bi • Pi)®(b2 • P2)e(b3 • P3)®(b4 • P4)e(b5 • P5)e(b6 • P6)e(b7 • P7)]®Vo 
' b'i=[(bo • P7)©(bi • Po)®(b2 • pi)e(b3 • p2)©(b4 • P3)®(b5 • P4)e(b6 • P5)e(b7 • p6)]©Vi 
b*2=[(bo • p^)e(b, • P7)e(b2 • po)e(b3 • Pi)e(b4 • P2)e(b5 * P3)®(b^ • P4)e(b7 • P5)]©V2 

b'3=[(bo • P5)©(b| • P6)©(b2 • P7)®(b3 • Po)e(b4 • Pl)©(b5 • P2)®(b6 • P3)e(b7 • P4)]eV3 
l)'4=[(bo • P4)®(b! • Ps)®(b2 • P«)e(b3 * P7)®(b4 • P0)®(b5 • Pl)©(b6 • P2)e(b7 • P3)]©V4 

b'5=[(bo • P3)©(bi • P4)e(b2 • P5)e(b3 • P6)®(b4 • P7)©(b5 • Po)®(b6 • Pi)e(b7 ■ P2)1©V5 

b'6^(bo - P2)®(b| • P3)©(b2 ' p4)eCb3 • P5)®(b4 • P6)©(b5 • P7)®(b6 • P0)e(b7 • Pl)3©V6 

b'HCbo • pi)e(bi • P2)e(b2 • P3)®(b3 • P4)©(b4 • p5)®(b$ - P6)e(b6 • P7)e(b7 • po)]ev7 

having p = pn PiPzPiPj^PiPfiP? as a load pattern consisting of { 1000 11 1 1 1 for the affine 
transformation and (00100 lOU for the inverse affine transformation and having v as a load 
vector = v nVi^V2VW4VsVj^V7 consisting of ( 1 10001 10) for the affine transformation and 
{101 00000} for the inverse affine transformation . 

13. (Previously presented) The apparatus as claimed in claim 12, wherein said means for 
obtaining the multiplicative inverse is a look-up table, and said means for performing the 
affine-all transformation is a combinational logic circuit. 

14. (Currently amended) A method for performing a SubByte function of a Rijndael round of 
the Rijndael Block Cipher, comprising the steps of 

creating a look-up table for the multiplicative inverse in the finite field GF(2'); 
providing an affine-all transformation consisting of an affine and inverse affine 
transformation in a single affine transformation , using the equations: 
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b'o=-[(bo • Po)e(bl • Pl)e(b2 • p2)e(b3 • P3)e(b4 • P4)e(b5 • P5)e(b6 • P6)e(b7 • P7)l©Vo 

^ b'i=l(bo • P7)©(bi • po)®(b2 • pi)e(b3 • p2)®(bi • P3)®(b5 • P4)e(b6 • P5)e(b7 • P6)]©V1 
b'2==[(bo • P6)®(b| • P7)®(b2 • po)e(b3 • pi)®(b4 • p2)©(b3 • P3)e.(be • P4)®(b7 • P5)]®V2 
b^=[(bo • P5)e(bi • P6)©(b2 • P7)®(b3 • po)e(b4 • Pi)e(b5 • P2)®(b6 • P3)®(b7 • P4)]®V3 

b*4=t(bo • P4)e(b| • p5)©(b2 • P6)e(b3 • P7)®(b4 • P0)e(b5 • pO®(b6 • P2)®(b7 • P3)]eV4 

b'5=[(bo • P3)®(bi • P4)©(b2 • P5)e(b3 • P6)©(b4 • P7)©(b5 • Po)®(b6 • Pi)©(b7 • P2)]®V5 
b'6=[(bo • P2)®(b| • P3)e(b2 • P4)®(b3 • Ps)eG>4 • P6)©(b5 • P7)®(b< • Po)e(b7 * Pl)]®V6 

b'KCbo • P!)®G>I • P2)®(b2 • P3)®(b3 • P4)®(b4 • P5)®(b$ • P6)e(b6 • P7)®(b7 • Po)]®V7 

having p = pnp iPgp^p4p^6p 7 as a load pattern consisting of { 10001 1 1 U for the affine 
transformation and {00100101} for the inverse affine transformation and having v as a load 
vector = vo vivgv^vav ^v^v? consisting of { 1 10001 101 for the affine transformation and 
110100000} for the inverse affine transformation : 

composing an S-box constructed of the look-up table and the affine-all transformation; 

and 

performing a non-linear byte substitution using the composed S-box. 

15. (Previously presented) The method of claim 14, wherein the providing step further 
comprises the step of providing a shared logic circuit that performs the single affine 
transformation. 

16. (Previously presented) The method of claim 14, further comprising the step of storing the 
look-up table in a read-only memory (ROM). 

17. (Previously presented) The method of claim 16, wherein the providing step further 
comprises the step of implementing a shared logic circuit that performs the single affine 
transformation. 
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18. (Previously presented) The method of claim 14, wherein: 

the look-up table is the multiplicative inverse in the finite field GF(2*) having {00} mapped to 
itself; and 

the providing step further comprises the step of implementing a combinational 
logic circuit that performs the single affine transformation. 

19. (Previously presented) The apparatus as claimed in claim 4, wherein, for a given input vector 
having a number of bits, the shared logic is configured to perform an inverse affine transform 
responsive to one load pattern and to perform an affme transformation responsive to another load 
pattern, the load patterns having the same number of bits as the input vector. 
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